Shieldlist

mail-auth-fail Free

Mail logins refused five times in ten minutes, counted without the password hash — the alternative to mail-auth for servers where auth_verbose_passwords cannot be turned on; off by default

Category
mail
Threshold
5/10m
Ban policy
auth
Report
mail-intrusion
Parsers
postfix-sasl-fail dovecot-auth-fail postfix-auth-ok dovecot-login-ok

Why it is written this way

Mail logins refused, counted WITHOUT the password hash: five refused
authentications in ten minutes from one address, SMTP and IMAP/POP
alike, a successful login forgiving three. This is the rule for a
server that cannot turn on dovecot's `auth_verbose_passwords` (off by
default everywhere): mail-auth and mail-auth-slow read nothing there.
OFF by default because it cannot tell a phone retrying one stale
password from a guesser — where the hash rules can. Turn it on when
the hash is not an option; leave it off beside mail-auth.
(Robin, 2026-09-22: « faire une règle alternative à proposer pour le
pack Plesk pour les gens n'ayant pas la conf ».)

The rule file View raw

# Mail logins refused, counted WITHOUT the password hash: five refused
# authentications in ten minutes from one address, SMTP and IMAP/POP
# alike, a successful login forgiving three. This is the rule for a
# server that cannot turn on dovecot's `auth_verbose_passwords` (off by
# default everywhere): mail-auth and mail-auth-slow read nothing there.
# OFF by default because it cannot tell a phone retrying one stale
# password from a guesser — where the hash rules can. Turn it on when
# the hash is not an option; leave it off beside mail-auth.
# (Robin, 2026-09-22: « faire une règle alternative à proposer pour le
# pack Plesk pour les gens n'ayant pas la conf ».)
rule: mail-auth-fail
state: off
description: "Mail logins refused five times in ten minutes, counted without the password hash — the alternative to mail-auth for servers where auth_verbose_passwords cannot be turned on; off by default"
about:
  purpose: >-
    Stop password guessing on mailboxes when Dovecot's password hashes are not in the log.
  blocks: >-
    Five refused authentications in ten minutes from one address, on SMTP or IMAP/POP; a successful login forgives three.
  applies_to: >-
    Any machine running Dovecot or Postfix SASL whose Dovecot does NOT log `auth_verbose_passwords`. Off by default: turn it on instead of mail-auth and mail-auth-slow, not beside them.
  requires:
    - >-
      The mail log, declared as `log: mail` — /var/log/mail.log on Debian and Ubuntu, /var/log/maillog on RHEL and its family.
    - >-
      The mail ports declared beside that log, so a ban closes the mail and leaves the websites alone.
  beware:
    - >-
      Without the hash this rule cannot tell a customer's phone retrying one stale password from a guesser: five retries in ten minutes is an hour off the mail ports. Prefer `auth_verbose_passwords = sha1:6` in Dovecot's conf.d/10-logging.conf and mail-auth whenever you can.
    - >-
      A mail gateway or webmail that authenticates for many of your users fails for many of them too: exempt it.
category: mail
parsers:
  - parser: postfix-sasl-fail
    weight: 1
  - parser: dovecot-auth-fail
    weight: 1
  - parser: postfix-auth-ok
    weight: -3
  - parser: dovecot-login-ok
    weight: -3
threshold: 5/10m
ban: auth
report: mail-intrusion